# Beats\_input\_raw\_event
**URL:** https://discuss.elastic.co/t/beats-input-raw-event/348575
**Category:** Logstash
**Created:** [December 4, 2023, 3:30pm UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575 "2023-12-04T15:30:22Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Yuval\_Algresi](https://discuss.elastic.co/u/Yuval_Algresi)
#### Post date: [December 4, 2023, 3:30pm UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575/1 "2023-12-04T15:30:22Z")
Hello,
I use winlogbeat to ship event viewer logs to my elastic stack.
It first goes to logstash and from there to elastic - I use beats input plugin.
Usually there is an event.original field that contains the raw event data (like it is in event viewer)
I sometimes use that field to create new fields.
But I noticed that some events have missing event.original field - and that those events always have this tag: beats\_input\_raw\_event
The logs go through the same pipeline - some have the field and not the tag and some the oposite
Does someone know what does this mean and how can I fix it?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 4, 2023, 5:08pm UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575/2 "2023-12-04T17:08:26Z")
Looking at the code [here](https://github.com/logstash-plugins/logstash-input-beats/blob/a6cdac9f80e21023ba6ea42c0cd55e6c0ab34a8d/lib/logstash/inputs/beats/message_listener.rb#L47), that tag gets added if no codec is called to decode the event. That appears to [happen](https://github.com/logstash-plugins/logstash-input-beats/blob/a6cdac9f80e21023ba6ea42c0cd55e6c0ab34a8d/lib/logstash/inputs/beats/message_listener.rb#L183) if there is no [message]/[line] field in the event. I don't think you can fix it in logstash.
---
### Author:  [@Yuval\_Algresi](https://discuss.elastic.co/u/Yuval_Algresi)
#### Post date: [December 10, 2023, 10:15am UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575/3 "2023-12-10T10:15:57Z")
Do you have any idea why this happens to some logs but not to all?
The logs go through the same process
Event viewer -\> winlogbet -\> logstash -\> elastic
They come frim the same server and go through the same pipeline in logstash
And yet they don't look the same as some have this problem and some don't
This makes using the message field to create new fields impossible
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 10, 2023, 10:28pm UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575/4 "2023-12-10T22:28:42Z")
> [@Yuval\_Algresi](#):
>
> Do you have any idea why this happens to some logs but not to all?
Like I said, it will happen to events that do not have a [message] field.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 7, 2024, 10:28pm UTC](https://discuss.elastic.co/t/beats-input-raw-event/348575/5 "2024-01-07T22:28:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.